News
More from RSA Conference 2023

Merritt Baer

CISO

Reco AI

Transforming digital landscapes: Cloud solutions, cybersecurity and AWS’ approach

Cloud solutions are shaking up digital transformation journeys for organizations everywhere, offering unmatched scalability, artificial intelligence capabilities storage and response time.With these perks, however, comes a rising threat facing every technological industry: cybersecurity. Keeping their customers safe is an obstacle Amazon Web Services Inc. faces daily as cyber threats rise. In fact, AWS has a dedicated team working around the clock to ensure a fully secure, efficient cloud experience for its clients

Info

Merritt Baer | AWS

Merritt Baer

CISO Reco AI

(inspiring music)

>> Hello everyone. Welcome back to theCUBE's Live coverage RSA 2023. I'm John Furrier host with you. Dave Vellante is flying in right now. He'll be landing shortly, four days of wall-to-wall coverage. We got all the best content here. Unpacking the security industry as it goes through what some are saying is an identity crisis. More more hacks than ever before, platform refactoring, cloud scale, and here to talk with is CUBE alumni Merritt Baer, Office of the CISO at Amazon Web Services. Merritt, great to see you Cube alumni, thanks for coming on.

>> Thank you for having me. You know, you can't use the word identity crisis as not a term of art when you're at a security conference Dave.

>> That was our headline of our two-part post we just rolled out on SiliconANGLE. But getting into like the whole, like it's never over, there's more money being spent than ever before. People still bolting on stuff, trying to build distractional layer, trying to build a platform when cloud scale is booming. The whole AI thing's right on the corner, throwing all this pollution out there with more code, writing hacks, auto generation, I mean.

>> Oh stop, no more buzzwords. (John laughs) John we can't do this, um, yeah, I think you're right, so security has always been an important element of any business's consideration. But I think what is really changing now is that it's become part of their innovation strategy, like it has to be part of what you are producing. Your downstream consumer cares about it, your end users, but so does the reliance of the business. And so if you want to do anything at scale, you have to be talking cloud. There's only automation that enables that kind of portability, modularity in your code, but also the ability to bend environments, the ability to do this kind of infrastructure as code, and then security as code, that's the way to scale.

>> Before we get into show topics, I want to ask you to explain what you do. You have the security, you have the security show on. You have the security show, which is a live show you do with all the industry partners, but also you have unique role at AWS. Explain what your job is day-to-day.

>> Yeah, it is a unique role. I, so I sit in AWS security and of course we are responsible for the security of AWS, the service teams, maybe folks are familiar, we are a tech company, we produce technology products, the security services, sorry, The service teams are responsible for the security of their teams and of their products. So it is actually an interesting role because I do a lot of work around securing ourselves. And then I also talk to customers and empathize with them about what it takes to do security at scale in the cloud. You know, we are a security shop that runs on AWS. So as a practitioner I can empathize, but a lot of times those conversations revolve around how they can emulate some of the behaviors that we have learned over time doing security at scale at the level that, you know, very few, if any enterprises really even tolerate, you know, when we're talking about the types of scalability and, and freedom that we want to afford.

>> I remember the scale's huge, I want get into that. I remember I was talking to Steve Schmidt, I think 2015, 14, and at that time all the traditional security, oh Amazon's not secure and he was on, he was like adamant, "Look, we are more secure. We have a large scale, we can create complexity or not." And so he was essentially, well I, I interpreted the more complexity of the architecture, meaning the size, the harder it can be. And I'll never forget that because now when you look at cloud as more secured now than on-premise and people are acknowledging that, what's, why is that the case and why is the cloud going to be a way to provide security via some point solution? Is it because it's not integrated, it's more system oriented? Is there, what's your your opinion on this?

>> There are so many ways in which cloud is an enabler and I think security is one of those. Like, don't get me wrong, I would love for enterprises and entities to move to the cloud because of security. I think there are real reasons there, including the fact that, you know, we take things off folks plates like our custom hardware, the Nitro ecosystem, that allows for folks to just take an entire category of risks off because we've developed it. But even aside from that, I actually think the reason that most customers move to the cloud is for that innovation stream. It's for the ease and flexibility and the freedom to let their developers run, to produce more, to be more resilient to, you know, have more and do more over time. That being said, no one would do anything if they didn't believe it could be secure. And so I think as we talk about cloud, the beauty is that you don't have to have like John over here babysitting your VMs, we do a lot of this and as you get further up in the managed services, we do more and more, right? So Lambda's a beautiful thing. The best patching is the patching you don't have to do. And the best, you know, security insights are the ones that you're getting vended to you then you can take action on. So things like GuardDuty and we just extended Lambda protection for GuardDuty last week. So like we're getting more and more customer-centric around simplifying that story. But just as a basic proposition cloud takes a whole category of off your table and we do investments that no individual customer would do for themselves.

>> Let me ask you two questions, a two-part question. What's the coolest thing you're working on right now and how, what's the coolest partner thing that's happening in the ecosystem?

>> Ah, interesting. So one of the cool things that I get to do is work with our perimeter protection team. So as you know, DDoS is just a giant category, distributed denial of service as a giant category of you know, attack factor, anything that's connected to the internet, right? And everything is connected to the internet. So I work with them a bit, we have a network of sensors that we leave deliberately unpatched to watch bad actors and see what they do. And we then derive our managed rule sets for things like WAF, you know, web application firewall and other things from that. We use it to protect ourselves and we also vend it to customers as these managed rule sets. So again, it's like this organic way in which we are uniquely positioned to see what bad actors are doing to then take notes and then sort of form this alliance. I think of this as like the Marvel of the good guy world.

>> Yeah, exactly.

>> Because don't worry, the bad guys are already out there talking to each other.

>> Multiple superhero for genre.

>> Yeah, ransomware as a service. Like you don't even have to be good these days, you know what I mean, you can just buy it. But we now are aligning our forces and from where we can see it, and of course we never look at customer content. We are looking at behavioral insights around, you know, domains and those kinds of things. And then we're able like as I sometimes say, don't do it in our backyard, we will watch you.

>> Yeah, and you got machine learning to help out too. You got all kinds of software to kind of look at the pattern, scale that out.

>> We exactly, we do. We have an entire network and we have some of the largest nodes of those kinds of predictive technologies which are looking over time, it's rad. And meanwhile we can tolerate the kinds of attacks that they want to do, which is rare, you know, like only someone like us can get into Clash of the Titans and consistently win.

>> It is Marvel that is very Marvel-like, I love that, I love that example because it literally is so many different kinds of superheroes involved and bad guys.

>> Yeah, I'm going to get my belt later.

>> I mean like it's, so there's like bad guys and good guys.

>> They're our personalities, yeah.

>> And it's the scale too is if they can take you down, if I'm a hacker, I'm sure they're targeting Amazon. It's got to be the target.

>> Sure I mean, but we also care deeply about making sure that our customers are able to tolerate slash resist and prevent, you know, there's this mix of protective, detective and responsive security mechanisms that we are affording folks. So you want to protective meaning like you put your shields up detective, meaning you're logging and monitoring and you're able to do, you know, like your forensics in the cloud or your log dives, you're not going to get into the hosts that's on our side. And then your remediative controls where you're doing these automations under the hood, which are Lamdas. You asked about partners, I forget what your specific question was, can you remind me?

>> What's the coolest thing that they're working on? Because obviously you have the Amazon thing, which is its own like own thing that's probably great to get deep dive in. It's the ultimate rabbit hole as I always say. But customers are also on top of the super cloud Amazon. They have software they're going to run with you, you have to enable them to be tied in, you mentioned GuardDuty, other things. What are the partners doing that are cool?

>> Yes, turn on GuardDuty, put MFA on, my public service announcement. (John laughs) So partners are doing a lot of interesting stuff and we have always had the opinionated view that there is a role for partners in this ecosystem. The best thing is what is right for the customer. So they should have an open world. Now I'm going to switch metaphors and go to like gaming, but like there should be a lot of freedom, a lot of choice. And yet like the ability to stick with what you want to use. And so I think unlike folks who package it and kind of say like, here's Barbie's Dream House, we do tend to be more Lego ish or whatever, Home Depot where there's all the ingredients and we know that then partners will help folks cobble those together to make a blueprint, to make a house, to make a whatever, you know, side cottage out back. But there's a lot of good work that partners are doing in CNAPP, Cloud-native posture management, in the kinds of MSSP work, like where they're actually managing your controls. We obviously have a shop called ProServe that will also help do this if folks want to have more opinionated folks at the keyboard. You know, like there's a lot of really interesting plays and of course anytime customers and I'm empathetic with this, are in multi environment, whether it's hybrid or on-prem and cloud, you know, there's going to be partner roles for the way that they will integrate their security story and they can pipe that into Security Hub.

>> I noticed you're wearing your crypto shirt, but your hair is covering up the logo.

>> Oh, here yes.

>> But it says "Amazon Cryptography." You were talking before you came on camera how there's a cool group, you got the shirt. Encryption's huge, I mean crypto, cryptography, the real crypto, not the crypto as in the shit coin market that everyone knows failed, but the real crypto, cryptography is about keys, hence the key. How important that's going to be technology, no latency problems anymore, it's all good. What's the update there? What's the cool story with cryptography?

>> So honestly I think folks don't realize that cryptography underpins a lot of what we think about as just run of the mill security. For example, we get half a billion requests per second at AWS from our customers, all of which need to not only have keys, but policies propagated. And so we actually roll their own crypto protocols to be able to do that. Meanwhile, I mean, which is a whole story that Eric Brandwein spent an hour on and that is worth digging into, but it is not anything to sniff at, like no one, the reason that we did that is that the existing cryptography protocols didn't tolerate the scale that we needed at the speed that we needed. And what really is interesting is we're also investing in how to resolve math, now that we are, as you mentioned, like cloud is this enabler and, and we're able to offload some security issues. Well now we're able to reason about them because we're not just worried about whether the VM is plugged in. We get to do do infrastructure as code, we get to do security as code. We have a group called the Automated Reasoning Group that is doing mathematical proofs around how secure it can be. And we use it on our side to prove that our cryptos or our boot code or other important elements are correct. And then we use it on the customer side to reason about permissioning. For example, an access analyzer or network analyzer and in inspector to prove network reachability. So without sending a single packet over the network, we can tell you whether you have an internet facing endpoint or not. And that's because we have infrastructure as code, we can reason about those. So yeah, I love KMS is just a thing of beauty, our key management system, where you just hit a button and it works. You know, like these were really clunky old world problems, until we invested really deeply. And Wickr, one of our recent acquisitions is also solving the consumer/enterprise problem of whether something is really end-to-end encrypted or not, because a lot of times that term gets thrown around too loosely.

>> And also the older systems can get modernized but also faster, they got to be at at high speeds, low latency, at scale, not an easy thing.

>> Right, yeah, you know, Jeff Bezos gave like an API mandate that everything has to be at API speed literally, and that security can never take a backseat. And so in order to do that we had to take a new and simple and elegant approach, but that takes investment, it takes work and yeah, I have a, like I'm a total crypto fan girl because it's part of the underpinning of what I think of as the reason I got into security, which is because walking through the world you care about, how you're human and kind of ephemeral existence is being taken care of and-

>> And protected.

>> Exactly, and cryptography is an essential element of not just getting stuff done, but being able to do it in a responsible way.

>> Awesome, well great job, you have an amazing job. You got some news I want to get to real quick that you mentioned, you guys announced the free MFA Key program. What is that and how's that's going?

>> Yeah, so as folks know, you know, MFA, multifactor authentication is one of the sort of baseline beauties that we should all be embracing everywhere. And hardware MFA is the current industry standard. So we have a program where if folks, you know, ask for it, we, and meet a couple criteria, we will send them MFA tokens. We really encourage folks to be doing this across the board. And to be honest, like as a security team, it's one of the things that we put in place for ourselves years ago. You know, it's, I think the philosophy at AWS is that we want to make the secure thing to do the easy thing to do. And to do that you put some guardrails around, you force folks to take the paved roads and then they have the freedom to play around within that, but in a, in a responsible and secure way. And so the MFA program is one that can literally-

>> It should be table, it should be table stakes.

>> It should be table stakes.

>> And that's just, that's that's like baseline.

>> Yeah. I mean it's, it's such a-

>> Obvious.

>> Well it's such an efficient use of security capital if you will or, you know what I mean? Like of, of, if you're going to make folks do something, do this, and if you don't have the tokens, ask us, we'll give 'em to you.

>> Okay, that's, and it's the free program. So now re:Inforce is coming up, we'll be there, Dave Vellante and I will be there with a small CUBE program. We'll be doing interviews and maybe getting the stories that's coming up for Amazon. That's your show. This is the security show kind of, this is turned into an industry trade show. It's pretty massive.

>> Merritt: You mean RSA?

>> RSA and re:Inforce coming together. What's the priorities around these shows, this year? KubeCon was really much, you know, developer, software supply chain. We were talking about developer coding on data. As AI is becoming more relevant and still not yet secure, you see hallucinations. So you can see more developer first kind of thinking like where they're driving action, they're driving the agenda. Here still feels like, I won't say old school security, but it kind of feels like old school security. You know, the vendors are out there, hawking their wears. You're talking about more encryption, cloud natives, talking about more platform, more automation, self tuning. You talked about reasoning. These are the trends that are going to make things better. What are the priorities for CISO? How do the, how do the customers unpack all this? What, what's in the minds of the CISO? What's the psychology of the CISO right now?

>> I think that CISOs who are looking towards the future are thinking about security as a bottom line imperative and not just how to lock things down. Because the term zero trust is one that is misleading. We're not talking about actually having it trusted. Like, you know, I sometimes say like, this is my zero trust water bottle, nothing comes in or out, forget it, right? Everything has to work and it has to be connected and you have to find ways to make it secure and to do it at scale. And so I think yes, like, you know, just personally, my view is that our re:Inforce conference is one that looks toward the future and that envisions security teams as the shop of yes. And as a business proposition that is not just like, I'm so sick of the like security as a cost center, like get out of here, you know? You know, what's a cost center when you don't do security?

>> Yeah, that's called going out business center. I mean that's going out business center.

>> Yeah, it's, well and like thoughtful architectures and especially now that we've, again like abstracted away a lot of this heavy lifting, thoughtful architectural decisions work well for availability, for reliability, for, you know, the considerations that a security team will take into account. And I think that as we see tooling advance, so things like in the encryption world, but also in, you know, governance models like AWS organizations, you can just delegate down permissioning. There are so many ways to do this in a really, I want to say beautiful, but like in a, in an attainable way for CISOs. And so I think what most CISOs, so I was listening to a podcast on the way over here on Havana syndrome and one of the keys takeaways is get off the X, like you're supposed to just move, like there is a risk to not moving. And I think like the point is you move because it's the right thing to do, but you also move because there is a risk to staying in place. So, you know, get off the X, like don't be the lowest target and also don't stand there while they target you.

>> You know, the slowest person speeding is the one that gets the ticket. (Merritt laughs) That's my philosophy. I always keep ahead, but don't be the last one. (laughs)

>> Stop.

>> Okay, so re:Inforce is coming up. What's, what can we expect from Amazon it's in Anaheim, California in June, we'll be there, like I said. What, what's the, what's some of the themes that you guys will be pushing forward that people might want know about and attend?

>> I have two talks. One will be on the kinds of security that you get from us that we have invested in. So things like that Nitro ecosystem of hardware that take off an entire category of threats, but also that allow us to do more, better, faster, you know, runtime updates and so on. That leads into the customer side. Things like KMS and S2N and you know, some of the protocols we've invested in some of the ways that we have invested in allowing customers to vend themselves security, but that are really like not a service. They are the ways that we want folks to behave securely and therefore we have, you know, invested in those inventions, so that's one talk. And then I am giving another one on how we derive the kinds of productization, like WAF Managed Rule sets from our raw threat intelligence and from, you know, whatever is is available around that. So there's really interesting ways in which, you know, CISOs ask me all the time, like, "Can I get your threat intel?" It's like you're getting it, it's in GuardDuty, it's in, you know, WAF Managed Rule Sets. It's in the ways that we-

>> John: They always want it, they always have FOMO.

>> Yeah, there's a little bit of misconception as if we have this like trove and it's like, no we are, we are giving it to you. We're, we're integrating it, you know what I mean? Those indicators of compromise that we then put into-

>> You guys have a lot more to work with to actually get the data, whether that's through honey potting or whatever, ways to get, lure in the bad guys and see patterns.

>> We have a unique vantage point for sure. And I think that our commitment is that we will sort of raise the ecosystem both through, you know, the rising tide with the boats, through both our customers inheriting some of that security that we give them and through us doing it ourselves. You know, being able to just be a player who contributes to that cleanup.

>> Well you guys have a lot to bring to the table and it's just been such a great journey to watch the security get better. I remember the people saying, "Oh there's no security in the cloud." You know, like that was like 13 years ago, right? And now it's so secure. It's more secure than the enterprise on premise is.

>> Absolutely, it's also just, I mean to be honest, security in the cloud is a luxury 'cause you get to worry about those, you know, top layers of the stack and there's so much managedness that you can avail yourself of in there, right, you know?

>> And a lot of the cool, I won't say you know, AI buzzword, but a lot of stuff coming out of the automation is the boring stuff that people forget, the config, the S3 buckets, it's MFA reminders, it's patches that are out there that haven't been put out there. So it's more application, so a lot more in assistance.

>> Yeah, computers are really good at certain things. Like Config Rules triggers every time there is a configuration change period. That's such a luxury, you know, just having that authoritative visibility around drift, that was never a thing that you could get in those manual days. And so I think it's both a developer tool and a security tool and done right it's really powerful and, and thoughtful.

>> Merritt, it's always great to have you on theCUBE, First of all, you're awesome. Great to get all that information fire hosed at me at once. (Merritt laughs) I, my real question I want to ask you is how is all this celebrityism going? How are you taking all the, being a celebrity on with your security show, it's such a hit.

>> Oh, it's such a-

>> How's that, how's that going?

>> You know, like the news crew were outside my house.

>> You're an influencer.

>> I'm an influencer. (John laughs) Yes, everyone who wants to follow me on Twitter for my toddler pictures and my dog. You know, yeah, it's been really fun. I have a Twitch live show called "Security Live" that goes on monthly with partners and with security leaders. We're going to have live iterations at re:Inforce too. Should be really fun, I really like it because we're able to break down some of the sales lingo and describe why folks should care, why this matters. What problem are we solving, you know? 'Cause ultimately I'm not in a sales role, I don't-

>> You're unpacking, you're not selling, you're, just having this authentic discussion with the partners on issues that matter.

>> Yep, exactly, and we're all, you know, I guess we'll come back to the Marvel theme, like we're all in this together on some level, right? And, and I want folks to be informed, to feel empowered and also to not like operate out of fear, to operate out of a sense of possibility.

>> All right, so my next question is the most important one, which is who's your agent? That we can sign you up for theCUBE host. Because you know, you want to come up and make sure you come on to theCUBE every year.

>> You know, Lisa Mayer from AWS PR, probably. (John laughs)

>> You guys are doing great work. Love the show, love the work you're doing. Huge important to get the stories out there, get the facts, share the best practices, just unpack the core issues.

>> Well, thank you. >> Thank you for coming on.

>> Yeah, we work really hard and it's a passion project. Do you know what I mean? Like this isn't, yes, I, it is my job, but I also like have what is probably an unhealthily passionate relationship.

>> I mean, you're doing, you're doing content which is very tribal community oriented and you got the hardcore, you know, security work going on. Great stuff.

>> Yeah, it's really the empathy between those worlds, right? It's like what are folks building, including us that we can make more secure? How do we do process and you know, people process and technology as AWS security and then how can I relate that out to customers and to the ecosystem that helps folks understand what we've learned. So I think that's always, you know, please take whatever we can impart because no one should have to learn it the hard way. (John laughs)

>> Video's great, Merritt Baer, thanks for coming on. This is theCUBE coverage here, RSA 2023. I'm John Furrier, host of theCUBE. Dave Vellante's flying in. We're going to have wall to wall coverage, four days and we're going to be here all week. Thanks for watching, be right back. (gentle electronic music)